This invention relates to secure communications in communication networks. More particularly, and not by way of limitation, the invention is directed to a system and method for managing cryptographic keys across different combinations of user terminals, access networks, and core networks.
FIG. 1 is a simplified block diagram of an evolution of current 3G networks for an Evolved Packet Core network (EPC) and an Evolved UTRAN radio access network (E-UTRAN) as currently defined by the Third Generation Partnership Project (3GPP). The overall evolved system (EPC and E-UTRAN) is referred to as the Evolved Packet System (EPS) 10. Nodes of the EPS architecture, which are important functional entities for the present invention include a Mobility Management Entity (MME) 11 and an enhanced Node B (eNodeB or eNB) 12. For completeness (but not essential to the present invention) it deserves mentioning that there are also two gateway nodes, a Serving Gateway 13 and a Packet Data Network (PDN) Gateway 14. The MME 11 is similar to the control plane of a Serving GPRS Service Node (SGSN) 15, and performs user authentication, terminates Non-Access Stratum (NAS) signaling security, and the like. For the purpose of this description, the eNB 12 can be seen as logically split into two parts. First, a User Plane Entity (UPE) 16 is similar to the user plane of a RNC and SGSN, and terminates UP (User Plane) security. The UPE functionality relevant to the present invention may be implemented in the eNB or elsewhere in the network. The other logical part of the eNB is an entity that terminates Radio Resource Control (RRC) security 17. A Home Subscriber Server (HSS) 18 stores subscriber profile information.
The EPS architecture 10 must interwork efficiently and securely with “legacy” (3GPP Rel6) core network equipment and associated radio access networks such as the GSM/EDGE Radio Access Network (GERAN) 19 and the UMTS Terrestrial Radio Access Network (UTRAN) 20. “Efficiently” means that handover is seamless, and “securely” means that a security compromise in one access network does not spread to other access networks (more than dictated by the need to be backwards compatible). It is assumed that the EPS architecture will use a Rel8-type Subscriber Identity Module (SIM) mechanism in the User Equipment (UE) 21 as the basis for security. Currently, only the use of R99+USIM is specified for EPS, but in one embodiment, the SIM may be an “extended” Subscriber Identity Module/UMTS Subscriber Identity Module (SIM/USIM), hereafter denoted xSIM.
The term “Rel6” refers to equipment of 3GPP Release 6 or earlier. The term “Rel8” is utilized herein to refer to EPC nodes and any UMTS/GSM core network equipment that has been made “EPS aware” and can thus interwork with the EPS architecture. For example, a Rel6 SGSN is assumed to be unable to handover to an EPC node because it does not implement the necessary protocols. However, a Rel8 SGSN is assumed able to do so by implementing the so-called S3 and S4 interfaces.
It is generally agreed in 3GPP that it is desirable for secure communications in the EPS architecture to meet the following requirements:                An enhanced xSIM, if deployed, must be backwards compatible with USIM for UTRAN/GERAN use, and keys must be independent of where an initial authentication takes place (GERAN, UTRAN, or E-UTRAN); authentication parameters shall have the same format; and the like.        The solution must work for all eight combinations of                    Rel6 or Rel8 UE            xSIM or USIM            Rel6 or Rel8 SGSN.It is not required that the solution work with the combination of an Rel6 UE and an eNB/E-UTRAN, as the Rel6 UE simply does not support the radio interface of E-UTRAN.                        The solution must work for all combinations involving a Rel8 EPS UE and any of the six configurations of xSIM/USIM, and Rel6 SGSN, Rel8 SGSN, or EPC MME.        The solution must work without any upgrade of the Rel6 RAN or CN equipment. New functions in Rel8 CN equipment are, however, allowed.        If initial attach and handovers (H/O) occur in a Rel8 environment (SGSN and EPC MME), then key separation when going between a UTRAN/GERAN network and an E-UTRAN network must be supported. (Key separation means that exposure of one key does not affect another key.)        The EPS architecture shall support key separation for UP, NAS, and RRC keys.        Exposure of E_UTRAN eNodeB keys shall have limited impact (RRC security re-established at idle-to-active transit).        
As an additional requirement, it would be beneficial if the enhanced xSIM could provide “master keys”, derived at access authentication, which can be securely used on the application layer even if access keys are exposed. Similarly, it would be desirable if a xSIM could support effective key-sizes above 128 bits.
There is no existing solution that meets all the above requirements. Principles similar to those used for GSM/UMTS interworking cannot be adopted because they do not provide the required level of security. Although GSM and UMTS specify an efficient interworking solution, they do not provide key separation between the accesses and hence a compromise of GSM affects UMTS security to some extent. For instance, the keys provided by GSM/UMTS cannot be re-used on the application layer without a risk of compromise. Additionally, neither GSM nor UMTS provides more than 128-bit security.
What is needed in the art is an efficient and secure system and method for managing cryptographic keys across different combinations of user terminals, access networks, and core networks. The system and method should meet all of the 3GPP EPS requirements. The present invention provides such a system and method and makes provisions for the later introduction of the xSIM satisfying the additional requirements.